Russia's communications regulator, Roskomnadzor, has added Apple and Microsoft to its register of "organizers of information dissemination" (ORI). The listing became public on 28 October 2026. Novaya Gazeta reports that the register entries are dated 2 October, citing the Telegram channel Tech Talk. Neither company has commented. The listing matters less for what it does on day one than for what it makes legally possible later.
The case for the rule
The strongest argument for ORI-style obligations is ordinary jurisdictional logic. A state can reasonably want a law-enforcement path to evidence about crimes committed on its territory. It can also reasonably want foreign platforms to have a legal presence it can hold accountable. Many democracies press for similar things: data-access treaties, local representatives, and retention orders. Seen this way, Russia is asking for what other governments ask for.
The design of the Russian regime is where that argument fails.
What the statute actually requires
Under Article 10.1 of Federal Law 149-FZ, an ORI must store inside Russia, for three years, information about the receipt, transmission, delivery or processing of users' messages, and information about the users. It must also store the content itself (text, voice, images, video) for up to six months. Part 3.1 requires the organizer to hand this information to state bodies engaged in operational-search or security work. The Moscow Times reports that the handover happens on request, outside any court procedure. Part 4.1 separately obliges organizers that use encryption to give the security service what it needs to decode messages.
The contrast with the democratic comparisons is plain. Those regimes generally route data requests through a judge, a warrant or a treaty process. Here the safeguard is the security service's own request.
Voluntary on paper, compulsory in practice
Registration was originally formally voluntary. The Moscow Times says Roskomnadzor gained the right to add organizations on its own initiative in 2024. It lists Cloudflare and 12 messengers, including WhatsApp, Skype and Wire, among those forcibly added since. Novaya Gazeta says it is unclear whether Apple and Microsoft were added voluntarily or by force, and notes that a magistrate court fined Apple 500,000 rubles in June for repeated failure to meet ORI duties. That is a sign the listing followed a dispute rather than a negotiation.
The enforcement ladder is steep but narrow. Article 13.31 of the Administrative Offences Code sets fines for failing to store or hand over user information at 800,000 to 1 million rubles for a legal entity, and 2 million to 6 million rubles for a repeat offence. The consultant.ru page also shows amendments taking effect on 3 November 2026 and flags that some parts have been revised, so the amounts in force should be checked. For companies the size of Apple and Microsoft these sums are trivial. The real instrument is the one the Moscow Times names: systematic non-compliance lets Roskomnadzor restrict access to the company's products.
The block is the point
The Moscow Times links the listing to Viber's December 2024 block and ties that block to ORI non-compliance. Roskomnadzor's public rationale at the time was different. The Record reports that the regulator said the app was used for terrorism, extremism, drug trafficking and illegal content. This gap is itself instructive. A single legal status supplies a reusable justification, and the stated reason can vary.
For Apple and Microsoft, a block would be far more disruptive than for a messenger. Operating systems, app stores, productivity software and cloud services are not interchangeable with a chat app. Any threat to restrict them is a threat to Russian businesses and households that depend on them, as well as to the foreign vendor. A fine that a multinational can ignore, paired with a block that only users feel, is an unusually effective form of pressure.
Spillover into circumvention tools
The Electronic Frontier Foundation reports in a 30 October post that VPN developers say their apps are again being pulled from Apple's App Store in Russia. EFF describes this as a crackdown on a tool that protects privacy and speech. The post does not give a count of removed apps or tie the removals to the ORI listing, so the two should not be treated as a single measure. They do point the same way. Apple becomes both a data custodian under Russian law and the gatekeeper for the tools people use to avoid that data collection.
What a proportionate approach would look like
The pro-innovation, pro-speech position does not require pretending that states have no legitimate interest in evidence. It requires that access be targeted, reviewed in advance by a court, limited in time, and proportionate to a defined offence. Retention for three years of metadata on every user, held in-country and open to unreviewed requests, meets none of those tests. It converts a general-purpose service into a standing surveillance resource.
Three things are worth watching. First, whether Apple and Microsoft publicly confirm the listing and say which services it covers. Second, whether Roskomnadzor starts the 13.31 process against either company. Third, whether further VPN removals follow. If the ORI status is used the way it was used on smaller services, the practical choice for the two companies will be between complying with unreviewed data access and leaving a market of millions of users. Neither outcome serves the open internet.